https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:03:31.739430+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-03T22:03:31.971826+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-365498 EUVD-2026-365498 2026-10-03T22:03:31.971892+00:00 EUVD-2026-365498 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40542 fkie_cve-2026-40542 2026-10-03T22:03:31.971910+00:00

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-v468-qcjx-r72w GHSA-v468-qcjx-r72w — Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification 2026-10-03T22:03:31.971935+00:00

Affected: Maven: org.apache.httpcomponents.client5:httpclient5

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

 https://cve.radiocsirt.org/vuln/rhsa-2026:60239 RHSA-2026:60239 — Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update. 2026-10-03T22:03:31.971957+00:00

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid httpclient: Apache HttpClient: Authentication bypass due to missing mutual authentication verification Apache MINA: Apache MINA: Arbitrary code execution via incomplete deserialization fix Apache MINA: Apache MINA: Arbitrary code execution via classname allowlist bypass Apache MINA: deserialization of untrusted data (incomplete fix for CVE-2026-41409) Apache MINA: Apache MINA: Arbitrary Code Execution via Classname Allowlist Bypass mina: mina: Arbitrary Code Execution via Deserialization Bypass jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing jenkins: Jenkins: Arbitrary code execution via deserialization of attacker-controlled configuration jenkins: Jenkins: Phishing attack via improper red…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-40542 UBUNTU-CVE-2026-40542 2026-10-03T22:03:31.972029+00:00

Affected: Ubuntu:Pro:14.04:LTS: httpcomponents-client, Ubuntu:Pro:16.04:LTS: httpcomponents-client, Ubuntu:Pro:18.04:LTS: httpcomponents-client, Ubuntu:Pro:20.04:LTS: httpcomponents-client, Ubuntu:22.04:LTS: httpcomponents-client, Ubuntu:24.04:LTS: httpcomponents-client, Ubuntu:25.10: httpcomponents-client, Ubuntu:26.04:LTS: httpcomponents-client

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.